CVE-2026-39314

What it actually does

CVE-2026-39314 is a local denial-of-service vulnerability in OpenPrinting CUPS 2.4.16 and earlier. The flaw is in _ppdCreateFromIPP() in cups/ppd-cache.c, where the job-password-supported IPP attribute is checked only for an upper bound. A negative value can pass validation, then be cast to size_t, wrapping to a very large unsigned length. That value is passed to memset() for a 33-byte stack buffer, causing cupsd, which commonly runs as root, to crash with SIGSEGV. The described impact is process availability loss, not code execution, data theft, or privilege escalation.

Why it matters to the business

A local user with the ability to interact with CUPS can repeatedly crash the printing service, disrupting print operations on affected Linux and Unix-like systems. In environments where CUPS is used for shared printers, print servers, kiosks, labs, offices, or production workflows, this can cause repeated print outages and support burden. The current EPSS is very low and stable, it is not listed in CISA KEV, and no mature exploit is reported, so broad internet-scale exploitation is not currently indicated; however, the issue is simple to trigger locally and can be repeatedly abused on multi-user systems.

How an attack unfolds

An attacker first needs local access to an affected host or another unprivileged execution context that can submit or influence CUPS IPP attributes. The attacker supplies a crafted IPP request or job-related attribute containing a negative job-password-supported value. CUPS processes the attribute in _ppdCreateFromIPP(), fails to reject the negative value, converts it to an unsigned size_t, and uses it as a memset() length against a small stack buffer. The invalid memory operation immediately crashes the cupsd root process. If systemd is configured to restart cupsd on failure, the attacker can repeat the request after each restart to create sustained denial of service for printing.

How to fix it

Upgrade OpenPrinting CUPS to a version newer than the affected 2.4.16-and-prior releases once a fixed package is available from the operating system or CUPS maintainers. Because no exact fixed version was provided in the input, use vendor advisories and distribution security channels as the source of truth for the corrected package version. Where immediate upgrade is not possible, reduce exposure by limiting local shell access, restricting who can submit print jobs, disabling CUPS on systems that do not require printing, blocking unnecessary access to CUPS listener ports, and applying systemd rate limiting to reduce repeated crash/restart loops. Consider configuring RestartSec, StartLimitIntervalSec, and StartLimitBurst for the cups service to prevent resource churn during repeated crashes, while understanding this mitigates restart storms but does not fix the underlying bug.

How to confirm the fix worked

Confirm the installed CUPS package is later than the affected 2.4.16-and-prior range or matches the fixed version published by the relevant OS vendor. On Linux systems, validate with package-manager queries such as rpm -q cups, dpkg -l cups, apt list --installed cups, or the distribution-specific package inventory tool. Confirm cupsd is restarted after patching so the fixed binary is active. Review systemd status and journal logs to verify there are no continuing cupsd SIGSEGV crashes after remediation. Where safe and authorized, security teams may use a vendor-provided regression test or non-disruptive scanner check; avoid running crash-triggering proof-of-concept tests on production print servers.

Typical attack path

1. Gain local unprivileged access to a Linux or Unix-like system running OpenPrinting CUPS 2.4.16 or earlier.
2. Confirm the CUPS scheduler is running and reachable locally through the normal CUPS interfaces.
3. Submit a crafted IPP request or print-related operation containing a negative job-password-supported attribute.
4. Trigger _ppdCreateFromIPP() processing of the malformed attribute.
5. Cause the negative value to wrap when cast to size_t and be used as an excessive memset() length.
6. Crash the cupsd process with SIGSEGV.
7. Repeat the trigger after service restart to sustain denial of service.

How to detect it

To determine whether this was already exploited, review host logs for unexplained or repeated cupsd crashes, especially SIGSEGV events followed by automatic systemd restarts. Useful sources include systemd journal logs for cups.service, /var/log/cups/error_log, /var/log/cups/access_log, kernel logs, auditd logs, core dump metadata from coredumpctl, and endpoint telemetry showing cupsd process termination. Look for crashes close in time to local print submissions or IPP requests that include unusual job-password-supported values. Because the vulnerability is a denial-of-service condition and may not leave a unique payload on disk, detection is primarily behavioral: repeated cupsd segmentation faults, core dumps referencing cups/ppd-cache.c or _ppdCreateFromIPP(), and service restart loops. Correlate crash timestamps with user sessions, local processes invoking printing utilities, IPP clients, and recent authentication events to identify the initiating account or process.

• job-password-supported
• _ppdCreateFromIPP
• cups/ppd-cache.c
• cupsd
• SIGSEGV
• segfault
• status=11/SEGV
• Main process exited, code=dumped, status=11/SEGV
• dumped core
• cups.service: Main process exited
• cups.service: Failed with result 'core-dump'
• cups.service: Scheduled restart job
• Restarting CUPS Scheduler
• CUPS Scheduler
• /var/log/cups/error_log
• /var/log/cups/access_log
• /var/lib/systemd/coredump/
• coredumpctl info cupsd

What your security team should do

• Prioritize patching shared print servers, multi-user Linux systems, lab systems, kiosk fleets, and any hosts where untrusted users can submit print jobs or execute local code.
• Inventory systems running OpenPrinting CUPS and identify versions 2.4.16 and earlier.
• If a fixed package is not yet available, apply compensating controls: disable CUPS where not needed, restrict local access, restrict printer administration, and limit network exposure to CUPS services.
• Monitor for repeated cupsd crashes, SIGSEGV events, core dumps, and systemd restart loops that may indicate attempted exploitation.
• Tune systemd restart limits for cups.service to reduce the operational impact of repeated crashes until patched.
• Escalate remediation if print availability is business-critical, even though EPSS is currently low, KEV status is false, and no mature exploit is reported.